Add Remote session foundations and feasibility checks

Add opt-in Tentacle protocol 1.1, explicit remote grants, lifecycle IPC and expiring core leases in both SDKs. Revoke access before update preparation, including failed updates.

Add transient secret entries, shared Braille cell export and isolated Xorg recovery experiments with focused tests and documented limitations. Production consent, desktop services and live interoperability remain pending.

internal/tentacle/registry.go

@@ -18,6 +18,8 @@ import (
 // Entry records an explicitly added local program or a verified package.
 // Discovery never adds entries. Enablement is desired state; failures retain it.
 type Entry struct {
+	SessionEvents      bool     `toml:"session-events,omitempty"`
+	RemoteGrants       []string `toml:"remote-grants,omitempty"`
 	ID                 string   `toml:"id"`
 	Program            []string `toml:"program"`
 	Directory          string   `toml:"directory,omitempty"`
@@ -36,7 +38,7 @@ type Entry struct {
 }
 
 func (entry Entry) Spec() Spec {
-	return Spec{ID: entry.ID, Program: append([]string(nil), entry.Program...), Directory: entry.Directory, Presentation: entry.Presentation, Interaction: entry.Interaction, ReaderSettings: entry.ReaderSettings}
+	return Spec{SessionEvents: entry.SessionEvents, RemoteGrants: append([]string(nil), entry.RemoteGrants...), ID: entry.ID, Program: append([]string(nil), entry.Program...), Directory: entry.Directory, Presentation: entry.Presentation, Interaction: entry.Interaction, ReaderSettings: entry.ReaderSettings}
 }
 
 type registryDocument struct {
@@ -64,6 +66,7 @@ func CloneEntries(entries []Entry) []Entry {
 	result := append([]Entry(nil), entries...)
 	for index := range result {
 		result[index].Program = append([]string(nil), result[index].Program...)
+		result[index].RemoteGrants = append([]string(nil), result[index].RemoteGrants...)
 	}
 	return result
 }